MCP server for Suricata IDS/IPS and Zeek NSM: analyze EVE JSON alerts, hunt threats, and manage rules from an AI client
Setup
Choose your client, copy the config, then fill in any required environment variables.
claude mcp add suricata --env SURICATA_EVE_LOG='<SURICATA_EVE_LOG>' -- npx -y suricata-mcp~/.codex/config.toml
[mcp_servers.suricata]
command = "npx"
args = ["-y", "suricata-mcp"]
env = { SURICATA_EVE_LOG = "<SURICATA_EVE_LOG>" }
# codex mcp add suricata --env SURICATA_EVE_LOG='<SURICATA_EVE_LOG>' -- npx -y suricata-mcp~/.cursor/mcp.json
{
"mcpServers": {
"suricata": {
"command": "npx",
"args": [
"-y",
"suricata-mcp"
],
"env": {
"SURICATA_EVE_LOG": "<SURICATA_EVE_LOG>"
}
}
}
}.vscode/mcp.json
{
"servers": {
"suricata": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"suricata-mcp"
],
"env": {
"SURICATA_EVE_LOG": "<SURICATA_EVE_LOG>"
}
}
}
}~/.gemini/settings.json
{
"mcpServers": {
"suricata": {
"command": "npx",
"args": [
"-y",
"suricata-mcp"
],
"env": {
"SURICATA_EVE_LOG": "<SURICATA_EVE_LOG>"
}
}
}
}claude_desktop_config.json
{
"mcpServers": {
"suricata": {
"command": "npx",
"args": [
"-y",
"suricata-mcp"
],
"env": {
"SURICATA_EVE_LOG": "<SURICATA_EVE_LOG>"
}
}
}
}.trae/mcp.json
{
"mcpServers": {
"suricata": {
"command": "npx",
"args": [
"-y",
"suricata-mcp"
],
"env": {
"SURICATA_EVE_LOG": "<SURICATA_EVE_LOG>"
}
}
}
}Environment variables
SURICATA_EVE_LOG
Replace the placeholders with your own credentials and keep them out of version control.